diff --git a/src/coap_subscribe.c b/src/coap_subscribe.c
index 5b497e38..4facf747 100644
--- a/src/coap_subscribe.c
+++ b/src/coap_subscribe.c
@@ -98,7 +98,7 @@ coap_persist_observe_add_lkd(coap_context_t *context,
   coap_opt_t *observe;
   int observe_action;
   coap_resource_t *r;
-  coap_subscription_t *s;
+  coap_subscription_t *s = NULL;
   coap_endpoint_t *ep;
 
   coap_lock_check_locked();
@@ -243,6 +243,7 @@ coap_persist_observe_add_lkd(coap_context_t *context,
       goto oscore_fail;
     oscore_key_id.s = info_buf;
     info_buf += oscore_key_id.length;
+    info_buf_len -= oscore_key_id.length;
 
     /* id_context */
     ret = oscore_cbor_get_next_element(&info_buf, &info_buf_len);
@@ -253,6 +254,7 @@ coap_persist_observe_add_lkd(coap_context_t *context,
         goto oscore_fail;
       id_context.s = info_buf;
       info_buf += id_context.length;
+      info_buf_len -= id_context.length;
       have_id_context = 1;
     } else if (ret == CBOR_SIMPLE_VALUE &&
                oscore_cbor_get_element_size(&info_buf,
@@ -268,6 +270,7 @@ coap_persist_observe_add_lkd(coap_context_t *context,
         goto oscore_fail;
       aad.s = info_buf;
       info_buf += aad.length;
+      info_buf_len -= aad.length;
       have_aad = 1;
     } else if (ret == CBOR_SIMPLE_VALUE &&
                oscore_cbor_get_element_size(&info_buf,
@@ -284,6 +287,7 @@ coap_persist_observe_add_lkd(coap_context_t *context,
         goto oscore_fail;
       partial_iv.s = info_buf;
       info_buf += partial_iv.length;
+      info_buf_len -= partial_iv.length;
       have_partial_iv = 1;
     } else if (ret == CBOR_SIMPLE_VALUE &&
                oscore_cbor_get_element_size(&info_buf,
@@ -300,6 +304,7 @@ coap_persist_observe_add_lkd(coap_context_t *context,
         goto oscore_fail;
       nonce.s = info_buf;
       info_buf += nonce.length;
+      info_buf_len -= nonce.length;
       have_nonce = 1;
     } else if (ret == CBOR_SIMPLE_VALUE &&
                oscore_cbor_get_element_size(&info_buf,
diff --git a/src/oscore/oscore_cbor.c b/src/oscore/oscore_cbor.c
index bafdc680..57ef7de8 100644
--- a/src/oscore/oscore_cbor.c
+++ b/src/oscore/oscore_cbor.c
@@ -279,8 +279,9 @@ oscore_cbor_get_element_size(const uint8_t **buffer, size_t *buf_len) {
 uint8_t
 oscore_cbor_elem_contained(const uint8_t *data, size_t *buf_len, uint8_t *end) {
   const uint8_t *buf = data;
-  const uint8_t *last = data + oscore_cbor_get_element_size(&buf, buf_len);
-  if (last > end) {
+  uint64_t size = oscore_cbor_get_element_size(&buf, buf_len);
+
+  if (size > 0xffffffff || data + size > end) {
     coap_log_err("oscore_cbor_elem_contained returns 1 \n");
     return 1;
   } else